Weaknesses of type CWE-434

3,103 results

Upload sem restrição de arquivo com tipo perigoso

Ocorre quando uma aplicação aceita upload de arquivos sem validar adequadamente seu tipo, extensão ou conteúdo. Um atacante pode enviar executáveis, scripts ou outros arquivos maliciosos, que serão armazenados ou executados no servidor, comprometendo sua integridade e segurança.

Example

Um formulário de perfil aceita qualquer arquivo como 'foto do usuário' sem checar extensão ou MIME type. Um atacante envia um arquivo .exe ou .php renomeado como .jpg, que é salvo no diretório web e posteriormente executado quando acessado, permitindo execução de código remoto.

How to mitigate

Valide uploads checando MIME type real (não apenas extensão), restrinja tipos permitidos de forma explícita, armazene arquivos fora da raiz web, desabilite execução de scripts no diretório de upload e considere usar vírus scanner. Implemente whitelist rigorosa, nunca blacklist.

CVE-2024-41454MEDIUMAn arbitrary file upload vulnerability in the UI login page logo upload function of Process Maker pm4core-docker 4.1.21-RC7 allows attackersEPSS 0.5%CVE-2025-6327CRITICALWordPress King Addons for Elementor plugin <= 51.1.36 - Arbitrary File Upload vulnerabilityEPSS 0.5%CVE-2024-1027MEDIUMSourceCodester Facebook News Feed Like Post unrestricted uploadEPSS 0.5%CVE-2026-22327CRITICALWordPress Restaurt theme <= 1.0.4 - Arbitrary File Upload vulnerabilityEPSS 0.5%CVE-2024-9278MEDIUMHuankeMao SCRM Administrator Backend WxkConfig.php upload_domain_verification_file unrestricted uploadEPSS 0.5%CVE-2026-23802CRITICALWordPress AI Engine plugin <= 3.3.2 - Arbitrary File Upload vulnerabilityEPSS 0.5%CVE-2026-2097HIGHFlowring｜Agentflow - Arbitrary File UploadEPSS 0.5%CVE-2025-54447HIGHUnrestricted Upload of File with Dangerous Type vulnerability in Samsung Electronics MagicINFO 9 Server allows Code Injection.This issue affEPSS 0.5%CVE-2025-23968CRITICALWordPress AiBud WP plugin <= 1.9 - Arbitrary File Upload vulnerabilityEPSS 0.5%CVE-2025-15495MEDIUMBiggiDroid Simple PHP CMS editsite.php unrestricted uploadEPSS 0.5%CVE-2025-34330MEDIUMAudioCodes Fax/IVR Appliance <= 2.6.23 Unauthenticated Prompt File Upload via ajaxPromptUploadFile.phpEPSS 0.5%CVE-2025-26927CRITICALWordPress AI Hub plugin <= 1.3.7 - Arbitrary File Upload vulnerabilityEPSS 0.5%CVE-2025-10081MEDIUMSourceCodester Pet Management System profile.php unrestricted uploadEPSS 0.5%CVE-2026-58428MEDIUMRelease attachment extension allowlist bypass via web release edit form (variant of CVE-2025-68939)EPSS 0.5%CVE-2025-11470MEDIUMSourceCodester Hotel and Lodge Management System manage_website.php unrestricted uploadEPSS 0.5%CVE-2025-67289CRITICALAn arbitrary file upload vulnerability in the Attachments module of Frappe Framework v15.89.0 allows attackers to execute arbitrary code viaEPSS 0.5%CVE-2025-5840MEDIUMSourceCodester Client Database Management System user_update_customer_order.php unrestricted uploadEPSS 0.5%CVE-2025-10600MEDIUMSourceCodester Online Exam Form Submission register.php unrestricted uploadEPSS 0.5%CVE-2025-10424MEDIUM1000projects Online Student Project Report Submission and Evaluation System faculty_controller.php unrestricted uploadEPSS 0.5%CVE-2025-11658MEDIUMProjectsAndPrograms School Management System changeSllyabus.php unrestricted uploadEPSS 0.5%